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Listing of Claims : 

1. (Currently Amended) An automatic detecting method for detecting 
protocol nonconformity, in Transmission Control Protocol/Internet Protocol 
(TCP/IP), occurring in a communication between transmitting and receiving 
terminals that make at least one transmitting and receiving control process in 
accordance with TCP/IP, in a case where at least one of: a communication 
apparatus does not perform its operation in accordance with specifications of the 
TCP/IP: an expected communication process is not performed in the TCP/IP due 
to false mounting; and an expected communication process does not operate in a 
new application because of a deficiency or defect in the TCP/IP, said method 
comprising: 

receiving at a network interface a packet transmitted or received in the 
communication between said transmitting and receiving terminals to transfer 
the packet for data retention, if it is necessary to save the packet, and to transfer 
the packet for packet analysis, unless it is necessary to save the packet; 

analyzing header information of the packet transferred from the receiving 
to transfer the header information and necessary payload information; 

creating state information, which is TCP connection information regarding 
a state of transmitting or receiving the packet to correspond to a result of 
transmitting and receiving control in accordance with said communication 
protocol, based on the header information and the payload information 
transferred from the analyzing; 

estimating normal information of a case where the transmitting and 
receiving control process is normally performed with the header information and 
the payload information received from the creating; 

storing beforehand nonconformity information featuring nonconformity in 
the transmitting and receiving control process, the nonconformity information 
being any one of a conditional formula regarding the TCP connection information, 
a conditional formula regarding the header information of the packet, and a 
combination thereof; and 
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comparing the analysis result of the analyzing, the TCP connection 
information created by the creating, the normal information estimated by the 
estimating, and the nonconformity information stored by the storing to detect the 
transmitting and receiving control process where said nonconformity has 
occurred. 

2.-3. (Cancelled) 

4. (Previously Presented) The automatic detecting method according to 
claim 1, wherein the step of creating further comprises updating said state 
information every time acquiring the packet, and the step of comparing further 
comprises comparing the latest state information updated at the step of creating 
and said nonconformity information. 

5. (Previously Presented) The automatic detecting method according to 
claim 1, wherein the TCP connection information includes an evaluation value 
having at least one of a total number of transmitted packets, a total number of 
retransmitted packets, a total number of Selective ACKnowledgement (SACK) 
blocks, a minimum packet size, a throughput of a maximum retransmitted 
interval, and a round trip time up to receiving a response packet to the 
transmitted packet. 

6. (Currently Amended) An automatic detecting apparatus for detecting 
protocol nonconformity, in Transmission Control Protocol/Internet Protocol 
(TCP/IP), occurring in a communication between transmitting and receiving 
terminals that make at least one transmitting and receiving control process in 
accordance with TCP/IP, in a case where at least one of: a communication 
apparatus does not perform its operation in accordance with specifications of the 
TCP/IP; an expected communication process is not performed in the TCP/IP due 
to false mounting; and an expected communication process does not operate in a 
new application because of a deficiency or defect in the TCP/IP, said apparatus 
comprising: 
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a packet receiving portion that receives at a network interface a packet 
transmitted or received in the communication between said transmitting and 
receiving terminals to transfer the packet for data retention, if it is necessary to 
save the packet, and to transfer the packet for packet analysis, unless it is 
necessary to save the packet; 

a packet filter/analysis portion that analyzes header information of the 
packet transferred from the packet receiving portion to transfer the header 
information and necessary payload information; 

a connection information calculating portion that creates state information, 
which is Transmission Control Protocol (TCP) connection information regarding 
a state of transmitting or receiving the packet to correspond to a result of a 
transmitting and receiving control in accordance with said communication 
protocol based on the header information and the payload information 
transferred from the packet filter/analysis portion; 

a normal information estimating portion that estimates normal 
information of a case where the transmitting and receiving control process is 
normally performed, with the header information and the payload information 
received from the connection information calculating portion; 

a nonconformity information saving portion that stores beforehand 
nonconformity information featuring nonconformity in the transmitting and 
receiving control process, the nonconformity information being any one of a 
conditional formula regarding the TCP connection information, a conditional 
formula regarding the header information of the packet, and a combination 
thereof; and 

a nonconformity comparison determining portion that compares the 
analysis result of the packet filter/analysis portion, the TCP connection 
information created by the connection information calculating portion, the 
normal information estimated by the normal information estimating portion, and 
the nonconformity information stored in the nonconformity information saving 
portion to detect the transmitting and receiving control process where said 
nonconformity has occurred. 
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7.-8. (Cancelled) 

9. (Previously Presented) The automatic detecting apparatus according to 
claim 6, wherein the TCP connection information includes an evaluation value 
having at least one of a total number of transmitted packets, a total number of 
retransmitted packets, a total number of Selective ACKnowledgement (SACK) 
blocks, a minimum packet size, a throughput of a maximum retransmitted 
interval, and a round trip time up to receiving a response packet to the 
transmitted packet. 
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